The vulnerability arises because the Goobi viewer core implements multiple Jakarta WebSocket endpoints that accept connections without validating the user's session or the Origin header. An unauthenticated attacker can therefore connect and, via the CampaignEndpoint, inject forged lock messages into the crowdsourcing page-lock map. This disrupts reviewers' workflow by presenting them with false lock states or blocking legitimate edits. The flaw is reflected in CWE‑1385 (Improper Control of Remote Socket), CWE‑306 (Missing Authentication for Sensitive Functionality), and CWE‑862 (Missing Authorization).

This flaw affects the intranda goobi‑viewer‑core component used by the Goobi viewer web application. Vulnerable releases span from version 4.11.0 up to, but not including, 26.05. Any deployment of the application running those versions and exposing the corresponding WebSocket endpoints is potentially impacted.

The CVSS score of 6.5 indicates a moderate severity risk. The EPSS score is not available at the time of this analysis, and the vulnerability is not listed in the CISA KEV catalog. An attacker can exploit it remotely by initiating a WebSocket connection from any external network address, as the service accepts a connection without any authentication checks or origin filtering. The lack of server‑side session validation allows the attacker to manipulate crowdsourcing state and cause denial of service to the review process.